Bugzilla – Bug 1224017
VUL-0: CVE-2024-24787: go1.21,go1.22: cmd/go: arbitrary code execution during build on darwin
Last modified: 2024-07-19 12:36:18 UTC
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive. Thanks to Juho Forsén of Mattermost for reporting this issue. This is CVE-2024-24787 and Go issue https://go.dev/issue/67119.
This is an autogenerated message for OBS integration: This bug (1224017) was mentioned in https://build.opensuse.org/request/show/1172535 Factory / go1.21 https://build.opensuse.org/request/show/1172536 Factory / go1.22
SUSE-SU-2024:1574-1: An update that solves one vulnerability and has one security fix can now be installed. Category: security (moderate) Bug References: 1212475, 1224017 CVE References: CVE-2024-24787 Maintenance Incident: [SUSE:Maintenance:33758](https://smelt.suse.de/incident/33758/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): go1.21-1.21.10-1.33.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1573-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1218424, 1224017, 1224018 CVE References: CVE-2024-24787, CVE-2024-24788 Maintenance Incident: [SUSE:Maintenance:33755](https://smelt.suse.de/incident/33755/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): go1.22-1.22.3-1.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1588-1: An update that solves one vulnerability and has one security fix can now be installed. Category: security (moderate) Bug References: 1212475, 1224017 CVE References: CVE-2024-24787 Maintenance Incident: [SUSE:Maintenance:33756](https://smelt.suse.de/incident/33756/) Sources used: openSUSE Leap 15.5 (src): go1.21-1.21.10-150000.1.33.1 openSUSE Leap 15.6 (src): go1.21-1.21.10-150000.1.33.1 Development Tools Module 15-SP5 (src): go1.21-1.21.10-150000.1.33.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): go1.21-1.21.10-150000.1.33.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): go1.21-1.21.10-150000.1.33.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): go1.21-1.21.10-150000.1.33.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): go1.21-1.21.10-150000.1.33.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): go1.21-1.21.10-150000.1.33.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1587-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1218424, 1224017, 1224018 CVE References: CVE-2024-24787, CVE-2024-24788 Maintenance Incident: [SUSE:Maintenance:33754](https://smelt.suse.de/incident/33754/) Sources used: openSUSE Leap 15.5 (src): go1.22-1.22.3-150000.1.15.1 openSUSE Leap 15.6 (src): go1.22-1.22.3-150000.1.15.1 Development Tools Module 15-SP5 (src): go1.22-1.22.3-150000.1.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.